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1 This action is in response to the communication filed on 7/15/2009. 

2 DETAILED ACTION 

3 Response to Arguments 

4 Applicant's arguments filed 6/4/2009 have been fiiUy considered but are moot in view of 

5 the new grounds of rejection presented below. The newly claimed limitations have been 

6 addressed accordingly below. 

7 All objections and rejections not set forth below have been withdrawn. 

8 Claims 1-27,29,32,33,35-44,48 and 49 have been examined. 

9 Information Disclosure Statement 

1 0 The information disclosure statement(s) (IDS) submitted on 7/29/2009 and 9/8/2009 are 

11 in compliance with the provisions of 37 CFR 1 .97. Accordingly, the examiner is considering the 

1 2 information disclosure statements . 

1 3 Claim Rejections - 35 USC §103 

14 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

1 5 obviousness rejections set forth in this Office action: 

16 A patent may not be obtained though the invention is not identically disclosed or 

17 described as set forth in section 102 of this title, if the differences between the subject matter 

1 8 sought to be patented and the prior art are such that the subject matter as a whole would have 

19 been obvious at the time the invention was made to a person having ordinary skill in the art to 

20 which said subject matter pertains. Patentability shall not be negatived by the manner in which 

2 1 the invention was made. 
22 

23 Claims 1-2, 4-16, 33, 35-44, and 48-49 are rejected under 35 U.S.C. 103(a) as being 

24 unpatentable over Burch et al. (US Patent AppUcation Publication 2005/0 1 7 1 872) hereinafter 

25 referred to as Burch, and fiirther in view of Brovick et al. ("WINDOWS® 2000 Active 
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1 Directory™") hereinafter referred to as Brovick, and further in view of Rao et al. (US Patent 

2 Number 5,689706) hereinafter referred to as Rao. 

3 Regarding claim 1, Burch disclosed a method comprising: storing, in a memory, 

4 instructions for performing the method; executing the instructions on a processor; according to 

5 the instructions being executed: receiving a first event notification (See Burch Paragraph 0043); 

6 evaluating the local credentials and the remote credentials (Burch Paragraphs 0039-0040) and 

7 synchronizing the local credentials and remote credentials (See Burch Paragraph 0043-0044), but 

8 Burch failed to specifically disclose enumerating local credentials and remote credentials in 

9 response to the event notification, that the evaluation was based on the enumerating, or wherein 

10 the event notification comprises a lock event. Burch did, however, disclose that the credential 

1 1 stores are directories (See Burch Paragraph 0022). 

1 2 Brovick teaches that Active Directory is a directory service, which provided replication 

13 of data between devices, as well as synchronization of the data between the devices in an Active 

14 Directory (See Brovick First Paragraph), and that in order to maintain synchronization between 

1 5 each copy of the directory, each update to a directory is provided with a USN which is compared 

1 6 with USNs in other devices to determine which updates need to be replicated (See Brovick 

17 "Keeping Track"). 

18 It would have been obvious to the ordinary person skilled in the art at the time of 

1 9 invention to employ the teachings of Brovick in the credential store system of Burch by utilizing 

20 Active Directory to provided the directory service and the synchronization between the 

2 1 credential stores. This would have been obvious because the ordinary person skilled in the art at 
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1 the time of invention would have been motivated to provide quick and efficient directory 

2 services across the distributed credential store. 

3 Rao teaches that in a synchronization system, the operating system can perform a lock 

4 function on the replicated data in order to prevent changes to the data during the synchronization 

5 (Rao Col. 16 Line 54 - Col. 17 Line 4). 

6 It would have been obvious to the ordinary person skilled in the art at the time of 

7 invention to have employed the teachings of Rao in the system of Brovick by performing the 

8 synchronization in response to locking the data. This would have been obvious because the 

9 ordinary person skilled in the art would have been motivated to prevent the data from being 

1 0 altered during the synchronization operation. 

1 1 Regarding claim 33, Burch disclosed a system comprising: an event handler to receive 

12 event notifications (See Burch Paragraph 0043-0044); and a synchronizing module operatively 

13 associated with the event handler to synchronize local credentials and remote credentials if the 

14 local and remote credentials are different from one another (See Burch Paragraph 0043-0044), 

1 5 but Burch failed to specifically disclose enumerating local credentials and remote credentials in 

1 6 response to the event notification, or wherein the event notification is at least one of the 

17 following: a lock event, and an unlock event. Burch did, however, disclose that the credential 

18 stores are directories (See Burch Paragraph 0022). 

1 9 Brovick teaches that Active Directory is a directory service, which provided replication 

20 of data between devices, as well as synchronization of the data between the devices in an Active 

2 1 Directory (See Brovick First Paragraph), and that in order to maintain synchronization between 

22 each copy of the directory, each update to a directory is provided with a USN which is compared 
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1 with USNs in other devices to determine which updates need to be replicated (See Brovick 

2 "Keeping Track"). 

3 It would have been obvious to the ordinary person skilled in the art at the time of 

4 invention to employ the teachings of Brovick in the credential store system of Burch by utilizing 

5 Active Directory to provided the directory service and the synchronization between the 

6 credential stores. This would have been obvious because the ordinary person skilled in the art at 

7 the time of invention would have been motivated to provide quick and efficient directory 

8 services across the distributed credential store. 

9 Rao teaches that in a synchronization system, the operating system can perform a lock 

1 0 function on the replicated data in order to prevent changes to the data during the synchronization 

1 1 (Rao Col. 1 6 Line 54 - Col. 1 7 Line 4). 

1 2 It would have been obvious to the ordinary person skilled in the art at the time of 

13 invention to have employed the teachings of Rao in the system of Brovick by performing the 

14 synchronization in response to locking the data. This would have been obvious because the 

1 5 ordinary person skilled in the art would have been motivated to prevent the data from being 

1 6 altered during the synchronization operation. 
17 

1 8 Regarding claim 2, Burch, Brovick, and Rao taught that synchronizing the local 

19 credentials and the remote credentials is based on at least one time-stamp associated with the 

20 local credentials and at least one time-stamp associated with the remote credentials (See Brovick 

21 Conflict Resolution). 
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1 Regarding claim 4, while Burch, Brovick, and Rao did not specifically teach that the 

2 synchronizing included error handling, it was well known in the art of data transmission to 

3 include error handling, and therefore would have been obvious to the ordinary person skilled in 

4 the art at the time of invention to have done so. 

5 Regarding claim 5, Burch, Brovick, and Rao taught writing at least one of the local 

6 credentials to a remote credential cache (See Burch Paragraph 0056). 

7 Regarding claim 6, Burch, Brovick, and Rao taught writing at least one of the remote 

8 credentials to a local credential cache (See Burch Paragraph 0053). 

9 Regarding claims 7-8, while Burch, Brovick, and Rao taught that changes in local 



10 credentials are duplicated in the remote credential store, and vice versa, they failed to specifically 

1 1 disclose deleting remote credentials. However, addition and deletion of credentials in a 

12 credential store is well known, and would have been obvious to the ordinary person skilled in the 

13 art at the time of invention. This would have been obvious because the ordinary person skilled in 

14 the art would have been motivated to have allowed flexibility in the authorizations granted 

1 5 within the system by allowing authorizations to be granted and taken away. 



16 Regarding claim 9, Burch, Brovick, and Rao taught modifying at least one of the local 

1 7 credentials at a local credential cache based on at least one of the remote credentials (See Burch 

18 Paragraph 0053). 

19 Regarding claim 10, Burch, Brovick, and Rao taught modifying at least one of the remote 

20 credentials at a remote credential cache based on at least one of the local credentials See Burch 

21 Paragraph 0056). 
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1 Regarding claim 1 1 , Burch, Brovick, and Rao taught updating a list of local credentials 

2 (See Brovick "Keeping Track"). 

3 Regarding claim 12, Burch, Brovick, and Rao taught updating a list of remote credentials 

4 (See Brovick "Keeping Track"). 

5 Regarding claim 13, Burch, Brovick, and Rao taught determining a state of the remote 

6 credentials dynamically (See Brovick "Intra-Site Rephcation" and "Inter-Site Replication"). 

7 Regarding claim 14, Burch, Brovick, and Rao taught maintaining a state file for the 

8 remote credentials (See Brovick "Keeping Track"). 

9 Regarding claim 15, Burch, Brovick, and Rao taught maintaining a state file for the local 

10 credentials (See Brovick "Keeping Track"). 

1 1 Regarding claim 16, Burch, Brovick, and Rao taught resolving a conflict of state between 

12 the local credentials and the remote credentials (See Burch Paragraph 0044 and Brovick 

13 "Conflict Resolution"). 

14 Regarding claim 35, Burch, Brovick, and Rao taught that the credentials include at least 

15 one of the following: an encryption credential, a token, an asymmetric key pair, a symmetric key, 

16 a digital certificate, an XrML license, an authentication credential, an authorization credential 

17 (See Burch Paragraphs 0022-0024). 

18 Regarding claim 36, Burch, Brovick, and Rao taught that a local store manager to 

19 enumerate the local credentials for the synchronizing module (See Brovick "Keeping Track"). 

20 Regarding claim 37, Burch, Brovick, and Rao taught that a remote store manager to 

2 1 enumerate the remote credentials for the synchronizing module (See Brovick "Keeping Track"). 
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1 Regarding claim 38, Burch, Brovick, and Rao taught that the local credentials are stored 

2 in a local cache (See Burch Paragraph 0053). 

3 Regarding claim 39, Burch, Brovick, and Rao taught that the local credentials are stored 

4 in a local cache provided at any number (n) of clients (See Burch Paragraph 0053). 

5 Regarding claim 40, Burch, Brovick, and Rao taught that the local credentials are 

6 encrypted using a master key (See Burch Paragraph 0025). 

7 Regarding claim 41, Burch, Brovick, and Rao taught that the remote credentials are 

8 stored in a remote cache (See Burch Paragraph 0056). 

9 Regarding claim 42, Burch, Brovick, and Rao taught that the local credentials are stored 

10 in a remote cache provided at any number (n) of hosts (see Burch Paragraph 0056). 

1 1 Regarding claim 43, Burch, Brovick, and Rao taught that the remote credentials are 

12 maintained by a remote directory service (See Burch Paragraphs 0022 and 0056). 

13 Regarding claim 44, Burch, Brovick, and Rao taught that the remote credentials are 

14 encr3q)ted (See Burch Paragraph 0025). 

15 Regarding claims 48-49, while Burch, Brovick, and Rao taught enumerating the local 



1 6 credentials and remote credentials in response to receiving an event notification (See the 

17 rejection of claim 1 above), they failed to specifically teach that the enumeration is performed in 

18 response to all of the following events: a startup event, a shutdown event, a logon event, a logoff 

19 event, an unlock event, a timer event, a manual request, a credential update event; and in 

20 response to at least one of a policy update, running a process, and connecting to a network. 

2 1 However, all of these events were known events which can trigger synchronization at the time of 
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1 the invention, and as such, it would have been obvious to the ordinary person skilled in the art at 

2 the time of invention to have included them as trigger events in the system of Burch. 

3 Claims 17, 18, 20-27, 29, and 32 are rejected under 35 U.S.C. 103(a) as being 

4 unpatentable over Burch, and further in view of Brovick, and further in view of Heinrich et al. 

5 (US Patent Number 6,51 0,522) hereinafter referred to as Heinrich. 
6 

7 Regarding claim 17, Burch disclosed a method comprising: receiving an event 

8 notification (See Burch Paragraph 0043); and synchronizing the local credentials and remote 

9 credentials (See Burch Paragraph 0043-0044) and changing at least one of the local credentials in 

10 a first local credential cache (Burch Paragraphs 0043-0044) wherein the credential comprises at 

1 1 least one of the following: a token (Burch Certificate), and an XrML license, but Burch failed to 

12 specifically disclose enumerating local credentials and remote credentials in response to the 

13 event notification. Burch did, however, disclose that the credential stores are directories (See 

14 Burch Paragraph 0022). 

1 5 Burch further failed to disclose a synchronization module which: sorts the local 

16 credentials and the remote credentials into a local credential array and a remote credential array 

17 respectively and linearly compares the local credential array and the remote credential array; and 

18 stores a state file for conflict resolution, the state file comprising: a file version; a flag, wherein 

1 9 the flag indicates whether the credential is user protected (but Burch did disclose that some 

20 credentials are user protected in Paragraph 0055); and a credential state, wherein the credential 

21 state comprises: last time synchronization module called; last time local store changed; and last 

22 time remote cache changed. 
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1 Burch further failed to disclose that the change to the first local credential was removal 

2 from the cache associated with a first device based upon the synchronizing module comparing 

3 the local credential array and the remote credential array, wherein the credential removed fi-om 

4 the first local credential cache is identified and tagged by the synchronization module in a remote 

5 credential cache; and based on the synchronizing module comparing the local credential array 

6 and the remote credential array, removing the tagged credential from a second local credential 

7 cache associated with a second device, wherein the first device is different than the second 

8 device, without rewriting the tagged credential to the remote credential cache. However, 

9 addition and deletion of credentials in a credential store was well known in the art at the time of 

1 0 invention, and would have been obvious to the ordinary person skilled in the art at the time of 

1 1 invention. This would have been obvious because the ordinary person skilled in the art would 

12 have been motivated to have allowed flexibility in the authorizations granted within the system 

13 by allowing authorizations to be granted and taken away. 
14 

1 5 Brovick teaches that Active Directory is a directory service, which provided replication 

16 of data between devices, as well as synchronization of the data between the devices in an Active 

17 Directory (See Brovick First Paragraph), and that in order to maintain synchronization between 

1 8 each copy of the directory, each update to a directory is provided with a USN which is compared 

19 with USNs in other devices to determine which updates need to be replicated (See Brovick 

20 "Keeping Track"). Brovick fiirther teaches keeping track of timestamps of when the local and 

2 1 remote (rephcated) data was updated (See Brovick "Conflict Resolution"), and when 

22 synchronization was last performed (See Brovick "Intra-Site Replication"). Brovick further 
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1 teaches that when a change in one local cache is made, the domain controller will mark the 

2 change in an up-to-date vector, and then replicate the change in other caches throughout the 

3 network without undoing the change (Brovick "Keeping Track"). 

4 Further, it was well known in the art at the time of invention to sort data into arrays for 

5 linear comparison in order to ease the complexity of the comparison, as well as to use flags to 

6 track Boolean properties. 

7 It would have been obvious to the ordinary person skilled in the art at the time of 

8 invention to employ the teachings of Brovick in the credential store system of Burch by utilizing 

9 Active Directory to provided the directory service and the synchronization between the 

10 credential stores. This would have been obvious because the ordinary person skilled in the art at 

1 1 the time of invention would have been motivated to provide quick and efficient directory 

12 services across the distributed credential store. It further would have been obvious to the 

13 ordinary person skilled in the art at the time of invention to have sorted the local and remote 

14 credentials into a local and remote credential array, and then linearly comparing the arrays to 

1 5 determine conflicts which need to be resolved. This would have been obvious because ordinary 

1 6 person skilled in the art at the time of invention would have been motivated to ease the 

17 complexity of the comparison for determining conflicts between the servers. In this 

1 8 combination, the USN reads on the claimed version number. Further still, it would have been 

1 9 obvious to the ordinary person skilled in the art at the time of invention to have stored a flag for 

20 each entry in the credential store to track whether the entry was personal (user protected) or not. 

2 1 This would have been obvious because the ordinary person skilled in the art would have been 

22 motivated to utilize a well known method for tracking Boolean properties to track the Boolean 
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1 property of personal entry or not. Even further still, it would have been obvious to the ordinary 

2 person skilled in the art at the time of invention to have employed the teachings of Brovick in the 

3 synchronization system by marking the deletion of a credential from the cache, and propagating 

4 the change to the other caches in the network. This would have been obvious because the 

5 ordinary person skilled in the art would have been motivated to synchronize the caches. 

6 Burch further failed to disclose that the event notification comprised an unlock event. 

7 Heinrich teaches that credentials can be protected from alteration by locking access to the 

8 memory locations containing the credentials, and that upon unlocking the memory the 

9 credentials can be updated (Heinrich Abstract). 

1 0 It would have been obvious to the ordinary person skilled in the art at the time of 

1 1 invention to have employed the teachings of Heinrich in the system of Brovick by locking and 

12 unlocking the memory locations holding the credentials, and performing the synchronization in 

13 response to unlocking. This would have been obvious because the ordinary person skilled in the 

14 art would have been motivated to prevent the data from being altered outside of the update and 

15 synchronization operations. 

16 Further still, Brovick failed to specifically disclose handling errors, wherein error 

17 handling comprises returning a write state indication of a status of a credential write operation, 

1 8 wherein the write state indication consists of one of the following: a none indication, wherein the 

19 none indication comprises an indication that the credential was not altered; a partial indication, 

20 wherein the partial indication comprises an indication that the credential was partially altered; or 

2 1 a done indication, wherein the done indication comprises an indication that the credential was 

22 successfiilly changed. However, it was well known in the art of data fransmission and 
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1 synchronization at the time of invention to provide an acknowledgement of successfiil 

2 synchronization in the event that the synchronization of the data was completed successfully. As 

3 such, it would have been obvious to the ordinary person skilled in the art at the time of invention 

4 to have employed ACBCs and NACKs of successful completion of synchronization. This would 

5 have been obvious because the ordinary person skilled in the art would have been motivated to 

6 ensure the synchronization operation was successful. 

7 Regarding claim 18, Burch, Brovick, and Heinrich taught that synchronizing the local 

8 credentials and the remote credentials is based on at least one time-stamp associated with the 

9 local credentials and at least one time-stamp associated with the remote credentials (See Brovick 

10 Conflict Resolution). 

1 1 Regarding claim 20, Burch, Brovick, and Heinrich taught writing at least one of the local 

12 credentials to a remote credential cache (See Burch Paragraph 0056). 

13 Regarding claim 21, Burch, Brovick, and Heinrich taught writing at least one of the 

14 remote credentials to a local credential cache (See Burch Paragraph 0053). 

1 5 Regarding claims 22-23, while Burch, Brovick, and Heinrich taught that changes in local 

16 credentials are duplicated in the remote credential store, and vice versa, they failed to specifically 

17 disclose deleting remote credentials. However, addition and deletion of credentials in a 

1 8 credential store is well known, and would have been obvious to the ordinary person skilled in the 

19 art at the time of invention. This would have been obvious because the ordinary person skilled in 

20 the art would have been motivated to have allowed flexibility in the authorizations granted 

2 1 within the system by allowing authorizations to be granted and taken away. 
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1 Regarding claim 24, Burch, Brovick, and Heinrich taught modifying at least one of the 

2 local credentials at a local credential cache based on at least one of the remote credentials (See 

3 Burch Paragraph 0053). 

4 Regarding claim 25, Burch, Brovick, and Heinrich taught modifying at least one of the 

5 remote credentials at a remote credential cache based on at least one of the local credentials See 

6 Burch Paragraph 0056). 

7 Regarding claim 26, Burch, Brovick, and Heinrich taught updating a list of local 

8 credentials (See Brovick "Keeping Track"). 

9 Regarding claim 27, Burch, Brovick, and Heinrich taught updating a list of remote 

10 credentials (See Brovick "Keeping Track"). 

1 1 Regarding claim 29, Burch, Brovick, and Heinrich taught determining a state of the 

12 remote credentials dynamically (See Brovick "Intra-Site Replication" and "Inter-Site 

13 Replication"). 

14 Regarding claim 32, Biirch, Brovick, and Heinrich taught resolving a conflict of state 

1 5 between the local credentials and the remote credentials (See Burch Paragraph 0044 and Brovick 

16 "Conflict Resolution"). 
17 

18 Claim 3 is rejected under 35 U.S.C. 103(a) as being unpatentable over the combination 

19 of Burch, Brovick, and Rao as applied to claim 1, and fiirther in view of Yianilos et al. (US 

20 Patent Apphcation Publication 2002/0029214) hereinafter referred to as Yianilos. 
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1 Burch, Brovick, and Rao disclosed detection of changes between local and remote 

2 credentials, but failed to disclose that the synchronizing was based on a comparison of hash 

3 values. 

4 Yianilos teaches an alternative method for detecting differences between entries in a 

5 synchronization system which involves generating a hash for the local data and a hash for the 

6 remote data, and comparing the hashes, wherein if the hashes are different then a change has 

7 been detected and synchronization is required (See Yianilos Paragraphs 0083 - 0084). 

8 It would have been obvious to the ordinary person skilled in the art at the time of 



9 invention to employ the teachings of Yianilos in the synchronization system of Burch, Brovick, 

10 and Rao by detecting changes by comparing hashes of the local and remote credential stores. 

1 1 This would have been obvious because the ordinary person skilled in the art would have been 

1 2 motivated to minimize the network traffic generated by the synchronization. 



13 Claim 19 is rejected under 35 U.S.C. 103(a) as being unpatentable over the combination 

14 of Burch, Brovick, and Heinrich as applied to claim 17, and further in view of Yianilos et al. (US 

15 Patent Apphcation Publication 2002/0029214) hereinafter referred to as Yianilos. 

16 Burch, Brovick, and Heinrich disclosed detection of changes between local and remote 

1 7 credentials, but failed to disclose that the synchronizing was based on a comparison of hash 

18 values. 

19 Yianilos teaches an alternative method for detecting differences between entries in a 

20 synchronization system which involves generating a hash for the local data and a hash for the 

2 1 remote data, and comparing the hashes, wherein if the hashes are different then a change has 

22 been detected and synchronization is required (See Yianilos Paragraphs 0083 - 0084). 
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1 It would have been obvious to the ordinary person skilled in the art at the time of 

2 invention to employ the teachings of Yianilos in the synchronization system of Burch, Brovick, 

3 and Heinrich by detecting changes by comparing hashes of the local and remote credential 

4 stores. This would have been obvious because the ordinary person skilled in the art would have 

5 been motivated to minimize the network traffic generated by the synchronization. 
6 



7 Conclusion 

8 Claims 1-27,29,32,33,35-44,48 and 49 have been rejected. 

9 Applicant's amendment necessitated the new ground(s) of rejection presented in this 

10 Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 

1 1 Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 . 1 36(a). 

12 A shortened statutory period for reply to this final action is set to expire THREE 



13 MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 

14 MONTHS of the mailing date of this final action and the advisory action is not mailed until after 

1 5 the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 

16 will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 

17 CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 

1 8 however, will the statutory period for reply expire later than SIX MONTHS from the date of this 

19 final action. 

20 Any inquiry concerning this communication or earlier communications from the 

2 1 examiner should be directed to MATTHEW T. HENNING whose telephone number is 

22 (571)272-3790. The examiner can normally be reached on M-F 8-4. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 



2 supervisor, William Korzuch can be reached on (571)272-7589. The fax phone number for the 

3 organization where this application or proceeding is assigned is 571-273-8300. 



5 Application Information Retrieval (PAIR) system. Status information for published applications 

6 may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

7 applications is available through Private PAIR only. For more information about the PAIR 

8 system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

9 system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 

10 like assistance from a USPTO Customer Service Representative or access to the automated 

1 1 information system, call 800-786-9 1 99 (IN USA OR CANADA) or 57 1 -272- 1 000. 



4 



Information regarding the status of an apphcation may be obtained from the Patent 



12 



13 
14 
15 
16 



/Matthew T Henning/ 

Primary Examiner, Art Unit 243 1 



